Batch pull (`/<ns>/batch/pull`) now resolves `{param}` collections: `{identity}`
auto-fills from the authenticated caller, other params via an optional
URL-encoded `params` query. The cap-cert resolver skips its URL path-scope check
for `/batch/*` (full sig/nonce/revocation verification unchanged) and the batch
handler enforces `scope.paths` per resolved key — a cap reads only keys its scope
covers. Hardening: `maxCollectionsPerBatch` cap, per-collection audit records
(plus a request-level record on degrade-to-anonymous), `list` reserved as a
namespace name, and an idempotent-enricher contract. Adds `batchPull` /
`batch_pull` client helpers. (TS + Python, with mirrored tests.)

Also includes the `AppendLogCursor` incremental append-only cursor and the
lockstep bump of all twenty packages to 3.0.0-alpha.9 / 3.0.0a9. See CHANGELOG.md
for full details.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>